﻿using System.Text;
using RAP.Framework.Libary.DomTemplateBuilder.Interface;

namespace RAP.Framework.Libary.DomTemplateBuilder.ContentRender.Pattern
{
	/// <summary>
	/// SQL文本处理
	/// </summary>
	public class SqlTextRender : ReplacePatternRender
    {
        /// <summary>
        /// 
        /// </summary>
        /// <param name="rootParamObject"></param>
        /// <param name="parentParamObject"></param>
        /// <param name="context"></param>
        /// <param name="fieldName"></param>
        /// <returns></returns>
		protected override object _getValueFun ( object rootParamObject, object parentParamObject, ITemplateRenderContext context, string fieldName )
        {
            object value = base._getValueFun( rootParamObject, parentParamObject, context, fieldName );
            if ( value != null && value is string )
            {
                //处理字符串中的 ' 号和 \ 号，防止SQL注入，为了更好的防止SQL注入以及保证SQL的鲁棒性，应该尽量使用参数化查询：$@参数名$
                var strValue = value.ToString();
                var sb = new StringBuilder();
                foreach ( var ch in strValue )
                {
                    switch ( ch )
                    {
                        case '\'':
                            sb.Append( "''" );
                            break;
                        case '\\':
                            sb.Append( @"\\" );
                            break;
                        default:
                            sb.Append( ch );
                            break;
                    }
                }
                return sb.ToString();
            }
            else
            {
                return value;
            }
        }
    }
}
